UK retailer Asos' stock falls 10%+ after users got app notifications saying “we have fully compromised the Snowflake instance”; source: Asos is investigating
Shares in FTSE 250 retailer fall more than 10% following reports from mobile users
Financial Times
Context & Ripple Effects
The allegation revives a 2024 campaign in which criminals listed hundreds of purported Snowflake customer credentials, followed by Snowflake’s confirmation that the AT&T breach was connected to the wider incident affecting other customers. The immediate importance is not just a possible data-platform exposure, but that the message reached shoppers through Asos’s own app.
Asos faces an immediate customer-communications and incident-response test after reports that its app carried the alleged attacker message, while its shares fell more than 10%.
The notification puts Asos’s handling of customer and payment-data questions under scrutiny even before the company establishes whether its Snowflake environment was compromised.
Second-order effects
Other Snowflake customers may face renewed questions about credential controls and monitoring because alleged customer credentials were previously listed by criminals in the 2024 Snowflake credential campaign.
For UK online retailers, a customer-facing alert turns cyber resilience into a visible commercial issue: the market reaction at Asos links an operational-security allegation directly to investor confidence.
Third-order effects
If retailers continue to suffer incidents that reach customer channels, cyber governance will be judged less as back-office compliance and more as protection of brand trust and market value.
The pattern favors ecosystem-wide defenses across cloud providers, retailers and their identity controls, rather than treating each retailer’s environment as an isolated security boundary.
The trend: Cyber incidents are becoming a direct retail-market risk as cloud and identity exposures can rapidly become customer-facing events.
Imagine if today was your start date on this job at ASOS. Someone comes to interrupt your onboarding session: 'um - are you the new DPO? There's been a message for you...'
ASOS is looking like a really unusual incident. The push notification included a link to a Telegram account which says payment information hasn't been affected. No explicit extortion demand or motivation expressed by Xuanye group, a branding that hasn't been heard of before.
‼️ BREAKING: ASOS was hacked and customers received a ransom note meant for ASOS, pushed through the app. Titled “ASOS HACKED”, it tells the company's data protection officer and IT team that attackers “fully compromised the Snowflake instance
Asos has just released an update following the cyber incident. It says an “an unauthorised customer notification” was sent to customers at around 10:00 BST today. “Basic personal information including name and contact details may have been accessed,” the statement says.
The ‘hackers’ add that we should be grateful for their Telegram statements: “Considering the current situation regarding incident disclosure in the cyber security landscape, you can thank us for our generous clarity regarding this incident.” #asos
New: Asos app is safe to use, say apparent hackers: “The affected organisations [sic] app is safe to use. The incident involves customer information, it is safe on our server, and is will not be touched for a designated period.” #asos
Payment info in the ASOS attack is allegedly not affected (if you trust attackers) but I would probably agree with that due to the Snowflake cloud data being the target